dsh-industry-finance: Financial Payment Compliance Clue Scanning for DeepSeek Harness

What Does It Do?

It is a DSH plugin for DeepSeek Harness that runs a finance-industry static clue check, screening code for seven problem classes: retained payment sensitive data, plaintext passwords, unmasked card numbers, retention shorter than ten years, cards stored on the client, plaintext transmission, and test environments pointing at production. It solves the payment-project problem where one small configuration later costs a great deal to explain, surfacing suspicious field names, DDL, logs, template interpolation, retention and transport settings together with the clause each clue comes from. Maintained by feely0208 under the MIT license, it is part of the DeepWhale security guard series and is deliberately a static clue checker, not a compliance audit.

Core Features

• Payment sensitive data retention check: flags cvv, cvn, track1/2, magnetic_stripe, card_pwd and pay_pwd in fields, models or config as high risk, since such data should not be retained.
• Plaintext credential check: catches passwords, PINs and SMS codes stored in plaintext columns, written to logs, or printed via System.out.
• Unmasked card display check: reports medium risk when ${cardNo} or {{cardNo}} is interpolated directly in templates or logs without mask, substring or a desensitization utility.
• AML ten-year retention check: raises a clue when transaction retention configuration falls short of ten years, covering the finance-specific retention line.
• False-positive suppression: high-risk rules carry applicability conditions and are skipped into a not-applicable list when no payment, card or client code exists; boundary cases such as card_mask, card_token, passwordEncoder, bcrypt, already masked values, desensitized card numbers, short-lived caches and intranet addresses are not reported.
• Reporting: produces an HTML report for screenshot archiving and can list rules with their sources for checking against the official text.

How to Use This Plugin?

After enabling it in DSH, run the demo mode to see sample findings, list the rules and their sources, then point it at a project root to scan that directory. Use the HTML output option when you need an archived report. It only reports locations and never edits code, and it does no data-flow analysis, runtime capture or database inspection; zero findings only mean no static clues were matched, and the official clause text prevails. Key management and algorithm strength, general sensitive-data scanning and general retention policy are handled by companion plugins, while this one focuses on payment sensitive data and financial clauses.

How to Troubleshoot This Plugin?

A report line saying N rules were not run because they are not applicable is not a failure: it means the project contains no payment, card or client code, so high-risk rules were skipped by design. If a clue looks like a false positive, first check whether the code matches a boundary case such as an existing mask, substring or desensitization call, or a desensitize switch in configuration, then verify the rule against the official clause text.